helpSavannah Administration - Support: sr #108600, Registration b0rked

 
 

sr #108600: Registration b0rked

Submitted by:  None
Submitted on:  Sat 14 Jun 2014 02:47:58 AM UTC  
 
Category: NonePriority: 5 - Normal
Severity: 3 - NormalStatus: None
Assigned to: NoneOriginator Email: -unavailable-
Operating System: NoneOpen/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 27 Jun 2014 12:16:08 PM UTC, comment #5:

I think that the requirement on passwd are good.
May be we could just explain how to craft a password fullfilling the requirements which does not imply a headache.

My usual favorite being to use the initial letter for each word of a phrase (possibly long) an replace 'to' with '2' or drop a '+' or '-' as separator and drop in some number of space for punctuation.

This usually fullfil most of "strong" passwd requirement and do not require a lot for remembering it.

Moroever if the passwd recovery process is efficient forgetting a passwd is not that bad. I'm speaking of passwd for the average project user not for sys admin of course.

Then my opinion is:

Keep strong requirement on passwd.
Give more advice about two 'create' strong passwd to the user.

Eric NOULARD <erk>
Site Administrator
Thu 26 Jun 2014 06:49:46 AM UTC, comment #4:

http://security.stackexchange.com/questions/32222/are-password-complexity-rules-counterproductive

Anonymous
Thu 26 Jun 2014 06:43:39 AM UTC, comment #3:

The password I was choosing should be plenty strong for this.
As far as the admins go, why not make them have more stringent requirements but reasonable requirements for normal users?

I strongly dislike how paranoid many Unix users/advocates are about security. My memory is quite poor so remembering complex passwords is next to impossible especially for sites I would rarely log in to. My only other option is to use a password manager (which is insecure)

Anonymous
Wed 25 Jun 2014 11:16:31 AM UTC, comment #2:

Whenever using services across the Internet, password requirements are anything but pointless. Especially here on Savannah, not only can a password leak breach your own account, but if this occurs to an administrator who has a weak password, it can also jeopardize the entire system.

The error messages returned could be slightly more informative, but it does not excuse bad password habits.

Caleb Xu <alebcay>
Site Administrator
Wed 18 Jun 2014 09:44:40 PM UTC, comment #1:

Password requirements are far too complicated to figure out
and pointless for something such as project hosting.

Rather then all the complication you should just put something obvious for normal people to figure out like an 8 character minimum

Anonymous
Sat 14 Jun 2014 02:47:58 AM UTC, original submission:

https://savannah.nongnu.org/account/register.php

"Bad passphrase (not enough different characters or classes for this length) Warning: Savane was not able to read "" site-specific information, please contact administrators"

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by erk (Posted a comment)
  • -unavailable- added by alebcay (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup